According to:

"this technique is mainly used when the attacker does not care about the response or the attacker has some way of guessing the response."

My Question is:
"or the attacker has some way of guessing the response"
?? How?

not counting that the machine behind the spoofed ip address is hacked by the attacker.

4 Answers 4


Sometimes the connection information inside a packet is predictable. TCP initial sequence numbers, for example, can be an issue if they are not random. See http://www.networkcomputing.com/unixworld/security/001.txt.html for one example. The same thing can also happen with DNS request ids.

Usually these attacks don't work on the first try, but will with several tries in quick succession. If you know that Bob just asked Alice where google.com resolves to, and you know the request id, you can tell Bob that it is your server by sending a packet that claims to be from Alice's IP address.


An example could be spoofing as part of a denial of service attack such as a Smurf Attack. The attacker knows what the respons will be, and where it will go, so doesn't need to receive it himself.

  • That would apply to the first part of the quote: "does not care about the response". But the OP was asking how "the attacker has some way of guessing"...
    – AviD
    Commented May 3, 2011 at 12:55
  • @AviD - I was meaning the attacker would know exactly what the response would be, but you're point is also true. Will pop something else up in a bit...
    – Rory Alsop
    Commented May 3, 2011 at 12:56
  • @RoryAlsop,please coud you take a look here and suggest a cool way:security.stackexchange.com/q/49487/35462 Commented Feb 3, 2014 at 15:54

An example of this guessing game is the now famous DNS flaw that Dan Kaminsky found in almost all dns implementations a few years ago (2008).

Basically the flaw could be exploited by shoving many replies to a forced dns request at a requesting server until one happened to have the correct return port and sequence (guessing is easier when you can do it thousands of times). Obviously this explanation is a long way from the complete story, see below for a far better argued explanation.

The Security Now Epsode 155 where Steve Gibson explained the flaw


If you're spoofing someone else's IP, chances are you aren't going to receive traffic back for that IP that your spoofing creates. You might want the spoofed machine that owns the IP to receive this traffic back though, say because you're conducting a denial of service attack.

(Silly example) Let's say you wanted a target machine to receive a million DNS responses. You construct a DNS query you know will result in a verbose response (so you are predicting the response because you are engineering it), you spoof the IP of the victim machine, and you send your query to a million DNS servers who all try to send their responses back to the spoofed machine. The victim machine is overwhelmed by the traffic it is getting because its IP was used in the attack.

People often mistake IP spoofing with Man-in-the-middle. In IP spoofing you're not standing in for the original machine, rather you're crediting it with whatever you're doing, this contrasted with Man-in-the-middle where you are actually spoofing two machines' IP, one is often a router and the other the target, and you act as intermediary, or man-in-the-middle between the two.

In the first case you don't care about the traffic your spoofing generates, whereas, in the second case you do.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .